553205_-_Redacted.pdf

JUSTIFICATION FOR OTHER THAN FULL AND

OPEN COMPETITION (OTFAOC)

Federal Acquisition Regulation (FAR) Part 6 Justification, Supporting Procurements under FAR Part 12, FAR Subpart 13.501, and FAR Part 15

Purchase Request Number: 553205 Contract Number: TBD Procurement Title: Access and Security Configuration Control (ASCC) Software Utility Service Contracting Office: Defense Information Systems Agency (DISA)/ Defense Information Technology Contracting Organization (DITCO) Scott/ PL8321 Estimated Value: REDACTED Statutory Authority: 10 U.S.C.§2304(c)(1) and FAR 6.302-1

JUSTIFICATION FOR OTFAOC

Justification for OTFAOC Number: JA15-034

Upon the basis of the following justification, I, as the Head of the Contracting Activity, hereby approve the use of OTFAOC of the proposed contractual action, pursuant to the authority of 10 U.S.C.§2304(c)(1) and FAR 6.302-1, only one responsible source and no other supplies or services will satisfy agency requirements.

JUSTIFICATION

1. REQUIRING AGENCY AND CONTRACTING OFFICE:

a. Requiring Agency:

DISA - Enterprise Information Services (EIS) Building 12, Overcash Avenue Letterkenny Army Depot Chambersburg, Pennsylvania 17201-4123

b. Contracting Office:

DISA/DITCO Scott/PL8321 2300 East Drive, Building 3600 Scott Air Force Base, Illinois 62225-5406

2. NATURE/DESCRIPTION OF ACTION(S):

a. The nature of this action is to procure brand-name, commercial off-the-shelf BMC BladeLogic software licensing and support for DISA’s ASCC software utility service. This project will be sustained under a software as a service (SaaS) model and perpetuate coverage under the current contract, REDACTED. Under this model, all required software licensing and application technical support will be provided by the contractor and will be priced on a utility (as used) basis. Government usage levels will be monitored and adjusted monthly to provide only the services and licensing necessary to meet the Government’s requirements. This procurement

BMC BladeLogic Support Renewal-JA15-034

Page 2 of 7 Pages will be awarded as a firm-fixed-price (FFP) contract to BMC (the original equipment manufacturer) or one of their authorized resellers, via the open market.

b. The period of performance will consist of a 1-year base period beginning on October 29, 2015 and includes four 1-year option periods. Fiscal year 2016 operation and maintenance funds will be provided on a forthcoming military interdepartmental purchase request document. The total estimated lifecycle cost is REDACTED. The applicable North American Industry Classification System (NAICS) code is 541519, Other Computer Related Services, with sales size standard of $27,500,000.

3. DESCRIPTION OF SUPPLIES/SERVICES:

a. This requirement is for the continued SaaS support of the BMC BladeLogic software products in support of DISA’s ASCC network management solution. Continued support of the tool will ensure compatibility with current and future hardware, software, application requirements, and infrastructure at the data centers. DISA EIS requires a single, integrated, and vendor-provided software service solution on a utility (“as used”) basis in support of the BMC BladeLogic software. The SaaS support must provide patch analysis and deployment, compliance scans, and remediation.

DISA’s ASCC technical solution utilizes proprietary BMC BladeLogic software applications to provide the required granular-level access control to operating systems and positive control of systems security configurations at all DISA-owned and approved DISA EIS processing locations. The BMC BladeLogic software allows DISA EIS to implement and verify granular-level access control and security configurations of all DISA EIS-managed servers in an integrated and automated fashion. The contractor will be required to continue to utilize the BladeLogic tool, which provides regularly recurring software support, updates, revisions, error detection and correction, and rights to new releases and/or versions. In addition, the contractor is required to provide error support 24 hours a day, 7 days a week, and 365 days a year, should errors be experienced.

b. The estimated lifecycle value is REDACTED. The following is a summary of the estimated costs for the base year and each option year:

REDACTED REDACTED REDACTED

REDACTED REDACTED REDACTED

REDACTED REDACTED REDACTED

Page 3 of 7 Pages

4. IDENTIFICATION OF STATUTORY AUTHORITY:

Only one responsible source, and no other supplies or services, will satisfy agency requirements, 10 U.S.C.2304(c)(1). (FAR 6.302-1/Defense FAR Supplement 206.302-1).

5. DEMONSTRATION OF CONTRACTOR’S UNIQUE QUALIFICATIONS:

a. Description of events. In 2007, DISA EIS (formally known as Computing Service Directorate) required a need for an ASCC solution. The BMC BladeLogic tool was procured, tested, evaluated, integrated, and deployed to reach current operational functionality that is provided by today’s ASCC solution. The tool is currently deployed within 10,000 systems throughout DISA. BladeLogic software is DISA’s tool to conduct vulnerability and security scans for network intrusions and cyber-attacks, which is a mission-critical requirement that must be available 24 hours a day, seven days a week in order to be effective at protecting the enterprise. The impact of suspension of these operations could leave the network vulnerable to cyber-attack and have catastrophic consequences. The BMC BladeLogic software toolsets have been accredited through the mandatory requirements of the DoD Information Assurance Certification and Accreditation Process. Continued BMC BladeLogic SaaS solution services using the BMC BladeLogic tool ensures compatibility with current hardware, software, and application requirements and infrastructure at the data centers and future hardware, software, and application requirements. The use of BMC BladeLogic software is essential to the Government’s requirements, thereby precluding consideration of a product manufactured by another company.

b. Justification.

(1) Minimum Government requirements. This requirement is for the continued SaaS support of the BMC BladeLogic software products in support of DISA’s ASCC network management solution. DISA EIS requires a single, integrated, and vendor-provided software service solution on a utility (“as used”) basis in support of the BMC BladeLogic software. The SaaS support must provide patch analysis and deployment, compliance scans, and remediation.

(2) Proposed sole source contractor. Not applicable. A proposed sole source contractor is not applicable to this procurement since market research indicates BMC and its authorized resellers can meet the Government's requirement.

(3) Discussion regarding cause of the sole source situation. Not applicable. A sole source situation is not applicable to this procurement, since the required software is available from BMC and its authorized resellers. The BMC BladeLogic tool was procured, tested, evaluated, integrated, and deployed to reach current operational functionality that is provided by today’s ASCC solution. The use of BMC BladeLogic software is essential to the Government’s requirements, thereby precluding consideration of a product manufactured by another company.

(4) Demonstration of unique source. The BMC BladeLogic software is the only known family of integrated software that is capable of supporting the wide variety of operating systems and computing environments found in the ASCC and DoD enterprise infrastructure. The

Page 4 of 7 Pages

BladeLogic software is the only software with the required functionality that can fully meet the Government’s requirements. The required BMC BladeLogic software products have proprietary features and a custom operating environment found only in the BMC brand-name software. In order to sustain the current operational software configuration baseline, only BMC BladeLogic products can satisfy the requirement. BMC software is proprietary; and licenses, upgrades, maintenance, and technical support are only available from BMC BladeLogic and their authorized resellers/providers. While other software with similar functionality is commercially available (Hewlett Packard Server Automation Suite, CA Change Manager Enterprise Workbench, etc.), BMC BladeLogic commercially available products are required to fit within the established DISA ASCC technical solution, which is engineered around BMC BladeLogic software products.

(5) Procurement discussion. It is not economically feasible to deviate from the currently installed BMC BladeLogic proprietary software base. Only BMC BladeLogic or their authorized resellers can legally obtain the access code necessary to integrate their products into the ASCC solution due to its protection under copyright and patent laws.

(6) Impact. REDACTED

6. FEDBIZOPPS ANNOUNCEMENT/POTENTIAL SOURCES:

a. A synopsis for this requirement will be published on the Federal Business Opportunities website as required by FAR 5.2.

b. A sources-sought announcement was issued in March of 2014, seeking information for potential sources for SaaS support for BMC BladeLogic software products in support of DISA’s ASCC network management solution. The sources sought was also used to determine the availability and technical capability of small businesses (including small disadvantaged businesses, HUBZone firms, certified 8(a) service-disabled veteran-owned small businesses, and woman-owned small businesses) to provide the required products and/or services.

Rightstar, a small business who has a formal partnership with Alvarez & Associates, was the only vendor to respond to the sources-sought announcement. Rightstar is capable of fulfilling the requirement via the National Aeronautics and Space Administration's Solutions for Enterprise-Wide Procurement so long as they partner with Alvarez & Associates.

7. DETERMINATION OF FAIR AND REASONABLE COST:

The government will perform an evaluation of the offeror’s proposal and proposed costs to ensure the costs are fair and reasonable. The contracting officer will determine that the resulting contract prices are fair and reasonable based on comparison with the cost or prices outlined below. The contracting officer will also determine the pricing information valid for comparative purposes. Certified cost or pricing data is not required for this acquisition, in accordance with FAR 15.403-1(b)(3). Proposal pricing will be compared with the following pricing information:

a. Historical and existing prices paid, whether by the government or other than the

Page 5 of 7 Pages government for the same or similar items.

b. Published price lists or published market prices for the same or similar items.

c. Independent government cost estimate for the required support renewal.

d. Competitively priced proposals received in response to the request for proposal.

8. MARKET RESEARCH:

a. DISA EIS conducted market research for the BMC BladeLogic SaaS solution from November 2013 to September 2014. The team surveyed the market through internet research, internal discussions, and vendor meetings.

b. Market research revealed that there are not two or more small businesses capable of fulfilling this requirement. Only one small business, Rightstar, responded to the sources-sought announcement; and in accordance with the representations and certifications detailed in the System for Award Management, Rightstar is not considered a small business under NAICS code 541519, Other Computer-Related Services ($27,500,000). Market research indicates that the required BladeLogic software is available on NASA SEWP from Rightstar, as well as the open market from BMC or one of their authorized resellers. BMC-authorized resellers include Deloitte Consulting LLP, Rightstar, Four Points Technology, and DLT Solutions. In order to promote competition, the required software will be procured via the open market and open to both large and small businesses.

9. ANY OTHER SUPPORTING FACTS:

None.

10. LISTING OF INTERESTED SOURCES:

REDACTED

11. ACTIONS THE AGENCY MAY TAKE TO REMOVE OR OVERCOME BARRIERS

THAT LED TO THE EXCEPTION TO FULL AND OPEN COMPETITION:

a. Procurement history:

b. At this time, it is deemed that only BMC BladeLogic products will function within the established DISA ASCC technical solution, which is engineered around BMC BladeLogic Software products. If BMC elects to surrender their legal ownership, copyright, and/or intellectual property rights and move toward a complete open-source solution; or if the

Page 6 of 7 Pages government determines that BMC BladeLogic products are no longer required, the government will seek full and open competition for the required functionality. Alternate software solutions will continually be researched to determine if they will function with currently used products. If a similar requirement arises, every effort will be made to compete to the maximum extent practicable.

12. REFERENCE TO THE APPROVED ACQUISITION PLAN (AP):

Page 7 of 7 Pages

TECHNICAL CERTIFICATION: REDACTED

REQUIREMENTS CERTIFICATION: REDACTED

CONTRACTING OFFICER CERTIFICATION: REDACTED

HEAD OF THE CONTRACTING ACTIVITY APPROVAL: REDACTED

ALL QUESTIONS REGARDING THIS JUSTIFICATION ARE TO BE REFERRED TO